# CVE-2026-111046: FOSSBilling authorization bypass in extension configuration management

Source: https://junglewise.ai/threats/cve-2026-111046-fossbilling-is-an-open-source-billing-and-client-management  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-19. Updated: 2026-10-19  
License: CC BY 4.0 with a link back

CVE-2026-111046 · Severity: info · Published 2026-10-19

FOSSBilling is an open-source billing and client-management platform that handles customer and service management. A low-privileged staff member can read decrypted secrets and modify the configuration of deactivated extension modules by exploiting a permission bypass in the extension configuration API. This allows attackers to access sensitive stored credentials and change how disabled modules behave without proper authorization checks.

Technologies: [FOSSBilling](https://junglewise.ai/threats/technologies/fossbilling). Vendors: [FOSSBilling](https://junglewise.ai/threats/vendors/fossbilling).

## Quick answers

**Is CVE-2026-111046 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-111046 being exploited in the wild.

**How severe is CVE-2026-111046?** Informational severity, published 19 October 2026.

**Which products and versions are affected?** FOSSBilling 0.8.4 to 0.8.5.

**Is there a fix for CVE-2026-111046?** Yes: fixed in 0.8.6. Until then: Restrict API access to the extension/config_get and extension/config_save endpoints to only highly-privileged administrative accounts until upgrading to version 0.8.6.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2026-10-19"},{"kind":"patched","at":"2026-08-23"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-111046 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-111046?** Check whether you run FOSSBilling at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 0.8.6

Restrict API access to the extension/config_get and extension/config_save endpoints to only highly-privileged administrative accounts until upgrading to version 0.8.6.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2026-10-19"},{"kind":"patched","at":"2026-08-23"}]

## Technical details

The hasManagePermission function fails open for inactive non-core modules because an early return on !isExtensionActive skips subsequent module-access and manage_settings permission checks. A staff account with module-level extension access can call api/admin/extension/config_get or api/admin/extension/config_save for a deactivated module, allowing the getConfig function to return decrypted stored configuration despite the module's inactive state. This is a regression in authorization logic that bypasses permission validation through a path not covered by earlier CVE-2026-62962 fixes.

## Affected products

- FOSSBilling FOSSBilling 0.8.4 to 0.8.5

## References

- [https://github.com/FOSSBilling/FOSSBilling/commit/7a7a30984b58cd1008a573fc70296a7653d8ae04](https://github.com/FOSSBilling/FOSSBilling/commit/7a7a30984b58cd1008a573fc70296a7653d8ae04)
- [https://github.com/FOSSBilling/FOSSBilling/pull/4184](https://github.com/FOSSBilling/FOSSBilling/pull/4184)

## Related threats

- [FOSSBilling stored XSS in support ticket notes](https://junglewise.ai/threats/cve-2026-111048-fossbilling-is-an-open-source-billing-and-client-management)
- [FOSSBilling CSRF vulnerability in staff guest login endpoint](https://junglewise.ai/threats/cve-2026-112374-fossbilling-before-0-8-9-contains-a-cross-site-request-forgery)
- [FOSSBilling email enumeration via guest signup endpoint](https://junglewise.ai/threats/cve-2026-111056-fossbilling-is-an-open-source-billing-and-client-management)
- [FOSSBilling path traversal in template_exists endpoint](https://junglewise.ai/threats/cve-2026-111053-fossbilling-is-an-open-source-billing-and-client-management)
- [FOSSBilling file overwrite via filename collision in downloadable products](https://junglewise.ai/threats/cve-2026-53648-fossbilling-file-overwrite-via-filename-collision-in-downloadable)